10530804

Identifying and Remediating Malware-Compromised Devices

PublishedJanuary 7, 2020
Assigneenot available in USPTO data we have
Technical Abstract

Patent Claims
20 claims

Legal claims defining the scope of protection. Each claim is shown in both the original legal language and a plain English translation.

Claim 1

Original Legal Text

1. A computer-implemented method, comprising: identifying, by a computing device, a mobile device at risk from malware; ranking, by the computing device, a set of connections of a user of the mobile device using a set of weighted parameters; identifying, by the computing device, a subset of the set of connections having a risk level greater than or equal to a predetermined risk level based on the ranking; and outputting, by the computing device, a malware notification for the mobile device at risk and at least one user computer device from the set of connections at risk from the malware.

Plain English Translation

This invention relates to cybersecurity and specifically addresses the problem of protecting mobile devices and associated user computers from malware. The method involves a computing device first identifying a mobile device that is considered to be at risk from malware. To assess this risk, the computing device then ranks a set of connections associated with the user of the mobile device. This ranking is performed using a predefined set of weighted parameters, which likely evaluate various factors contributing to connection risk. Following the ranking, the computing device identifies a subset of these connections. This subset includes only those connections that have been determined to have a risk level equal to or exceeding a predetermined threshold. Finally, the computing device generates and outputs a malware notification. This notification is intended for both the mobile device identified as being at risk and at least one user computer device that is part of the identified subset of at-risk connections. This ensures that both the mobile device and potentially compromised connected computers are alerted to the threat.

Claim 2

Original Legal Text

2. The computer-implemented method of claim 1 , wherein outputting the malware notification comprises outputting the malware notification to at least one user computer device of the subset of the set of connections.

Plain English Translation

This invention relates to cybersecurity, specifically to detecting and notifying users about malware within a network. The problem addressed is the need to efficiently identify malware-infected devices and alert affected users to prevent further spread. The method involves analyzing network connections to detect malware activity, identifying a subset of connections associated with the malware, and then outputting a malware notification to at least one user computer device within that subset. The notification alerts the user to the presence of malware, enabling them to take corrective action. The system may also include steps to isolate infected devices or block malicious traffic to mitigate the threat. The approach improves security by providing targeted alerts to affected users, reducing the risk of malware propagation within the network. The method is computer-implemented, leveraging automated analysis to quickly identify and respond to threats. The focus is on minimizing user disruption while ensuring timely detection and notification of malware infections.

Claim 3

Original Legal Text

3. The computer-implemented method of claim 1 , further comprising identifying, by the computing device, the set of connections of the user of the mobile device, wherein each connection in the set of connections is associated with a user computer device.

Plain English Translation

This invention relates to a computer-implemented method for managing user connections in a mobile device network. The method addresses the challenge of efficiently identifying and utilizing the connections of a mobile device user to enhance communication or data sharing capabilities. The system involves a computing device that detects the presence of a mobile device within a defined area, such as a geofenced region, and establishes a communication link with the mobile device. The computing device then identifies a set of connections associated with the user of the mobile device, where each connection corresponds to a user computer device. These connections may include other devices or users linked to the mobile device user, enabling the system to leverage these relationships for various purposes, such as targeted messaging, data synchronization, or collaborative tasks. The method ensures that the identified connections are authenticated and authorized before any further actions are taken, maintaining security and privacy. By dynamically recognizing and utilizing the user's network of connections, the system improves the efficiency and relevance of interactions within the mobile device ecosystem.

Claim 4

Original Legal Text

4. The computer-implemented method of claim 3 , wherein the set of connections are social media connections.

Plain English Translation

This invention relates to a computer-implemented method for analyzing and utilizing social media connections to enhance data processing or decision-making. The method involves identifying a set of social media connections between users, where these connections represent relationships such as friendships, followers, or professional networks. The method then processes these connections to extract meaningful insights, such as influence patterns, community structures, or user preferences. These insights can be used to improve recommendations, targeted advertising, content personalization, or other applications where understanding social relationships is valuable. The method may also involve analyzing the strength or type of connections (e.g., mutual vs. one-way) to refine the accuracy of the derived insights. By leveraging social media connections, the method provides a more context-aware approach to data analysis compared to traditional methods that do not account for social relationships. This can lead to more relevant and personalized outcomes in various digital services.

Claim 5

Original Legal Text

5. The computer-implemented method of claim 3 , wherein the set of connections are inter-enterprise connections.

Plain English Translation

This invention relates to computer-implemented methods for managing inter-enterprise connections, addressing challenges in securely and efficiently linking systems across different organizations. The method involves establishing and maintaining a set of connections between enterprise systems, where these connections facilitate data exchange, collaboration, or integration between distinct business entities. The connections are configured to ensure secure, authenticated, and authorized communication while maintaining compliance with enterprise policies and regulatory requirements. The method may include monitoring the connections for performance, security threats, or compliance violations, and dynamically adjusting connection parameters or terminating connections as needed. Additionally, the method may involve validating the identity of connected systems, encrypting transmitted data, and logging connection activities for auditing purposes. The invention aims to streamline inter-enterprise interactions while mitigating risks associated with cross-organizational data sharing.

Claim 6

Original Legal Text

6. The computer-implemented method of claim 1 , further comprising identifying a type of the mobile device.

Plain English Translation

A computer-implemented method for mobile device management involves identifying the type of a mobile device to optimize system operations. The method addresses the challenge of efficiently managing diverse mobile devices with varying capabilities and configurations. By determining the device type, the system can tailor processes such as data processing, security protocols, or user interface adjustments to enhance performance and compatibility. The identification process may involve analyzing hardware specifications, software versions, or device identifiers to classify the device accurately. This classification enables the system to apply specific rules or settings that align with the device's characteristics, ensuring seamless integration and functionality. The method may also include additional steps such as authenticating the device, monitoring its status, or applying updates based on the identified type. This approach improves efficiency, security, and user experience across different mobile devices.

Claim 7

Original Legal Text

7. The computer-implemented method of claim 6 , wherein the identifying the type of the mobile device comprises identifying one of the group consisting of: a make of the mobile device, and a model of the mobile device.

Plain English Translation

This invention relates to mobile device identification in a computer-implemented system. The problem addressed is the need to accurately determine the type of a mobile device, such as its make or model, to enable tailored functionality or services. The method involves analyzing device characteristics to identify whether the device is a smartphone, tablet, or other mobile form factor, and further classifying it by make and model. This identification process may involve examining hardware specifications, software configurations, or network interactions. The system then uses this classification to adapt its operations, such as optimizing performance, enabling specific features, or delivering device-specific content. The invention ensures compatibility and enhances user experience by dynamically adjusting based on the detected device type. This approach is particularly useful in applications requiring precise device recognition, such as mobile app development, network optimization, or personalized service delivery. The method improves upon prior systems by providing more granular device identification, reducing errors in device classification, and enabling more precise customization.

Claim 8

Original Legal Text

8. The computer-implemented method of claim 6 , wherein the identifying the type of the mobile device comprises identifying the type of the mobile device from user-agent information received from the mobile device during a login event.

Plain English Translation

A system and method for mobile device identification in a networked environment. The invention addresses the challenge of accurately determining the type of mobile device accessing a service, which is critical for optimizing performance, security, and user experience. The method involves analyzing user-agent information transmitted by the mobile device during a login event to identify the device type. User-agent data typically includes details such as the device model, operating system, and browser version, which are parsed to classify the device. This classification enables the system to apply device-specific configurations, such as tailored security protocols, optimized content delivery, or compatibility adjustments. The method ensures real-time identification without requiring additional user input or device-specific software, improving efficiency and reducing errors in device recognition. By leveraging existing login interactions, the solution minimizes computational overhead and enhances the accuracy of device profiling in dynamic network environments. The approach is particularly useful in applications where device-specific behavior is essential, such as mobile banking, enterprise access control, or personalized content delivery.

Claim 9

Original Legal Text

9. The computer-implemented method of claim 8 , further comprising: determining, by the computing device, a type of browser used by the mobile device based on the user-agent information; and determining, by the computing device, whether the browser used by the mobile device is supported by the computing device.

Plain English Translation

This invention relates to a computer-implemented method for optimizing web content delivery to mobile devices based on browser compatibility. The method addresses the problem of inconsistent user experiences when mobile devices with unsupported browsers attempt to access web content, leading to rendering issues or functionality failures. The method involves a computing device receiving a request from a mobile device to access web content. The computing device extracts user-agent information from the request, which identifies the mobile device's browser type. The computing device then determines the browser type based on this information and checks whether the browser is supported. If the browser is unsupported, the computing device may redirect the mobile device to a compatible browser or provide an alternative version of the content. This ensures that users with unsupported browsers still receive a functional and optimized experience. The method may also include additional steps such as analyzing the mobile device's capabilities, such as screen size or processing power, to further tailor the content delivery. By dynamically assessing browser compatibility and device capabilities, the system improves accessibility and performance for mobile users.

Claim 10

Original Legal Text

10. The computer-implemented method of claim 1 , further comprising accessing malware risk data, wherein the accessing the malware risk data comprises accessing the malware risk data in a remote risk data server through a network.

Plain English Translation

This invention relates to computer security, specifically methods for assessing and mitigating malware risks in digital systems. The method involves analyzing software applications to detect potential vulnerabilities or malicious behavior that could expose a system to malware attacks. A key aspect is the integration of remote risk data, which provides up-to-date threat intelligence to enhance the accuracy of malware risk assessments. By accessing malware risk data from a remote server over a network, the system can dynamically compare application behavior against known threats, improving detection capabilities. The method may also include evaluating the risk level of detected threats and applying appropriate security measures, such as blocking or quarantining high-risk applications. The remote data access ensures that the system remains current with emerging threats, reducing the likelihood of undetected vulnerabilities. This approach enhances cybersecurity by combining local analysis with external threat intelligence, providing a more comprehensive defense against malware.

Claim 11

Original Legal Text

11. The computer-implemented method of claim 1 , wherein the malware risk data comprises anti-virus software.

Plain English Translation

A computer-implemented method detects and mitigates malware risks by analyzing software applications, including anti-virus programs, to identify potential security vulnerabilities. The method involves scanning software for indicators of malicious behavior, such as suspicious file modifications, unauthorized network access, or execution of untrusted code. Anti-virus software is evaluated to determine if it is up-to-date, properly configured, and capable of detecting known and emerging threats. The system generates risk data by assessing the effectiveness of the anti-virus software in preventing, detecting, and responding to malware attacks. This data is used to prioritize security measures, such as updating software, applying patches, or isolating infected systems. The method may also integrate with other security tools to provide a comprehensive threat assessment. By continuously monitoring and analyzing anti-virus software performance, the system helps organizations reduce the likelihood of successful malware infections and minimize their impact. The approach ensures that security defenses remain effective against evolving threats.

Claim 12

Original Legal Text

12. The computer-implemented method of claim 1 , wherein the parameters comprise at least one of: riskiness of an application used by a connection, wherein the riskiness of the application is positively correlated with a security risk; the reputation of one or more social media applications being used by the connection; and detected anomalies in activities within a social media network of the user of the mobile device.

Plain English Translation

This invention relates to a computer-implemented method for assessing security risks associated with mobile device connections, particularly in social media and application usage contexts. The method evaluates parameters to determine potential security threats, focusing on three key factors: the riskiness of applications used by a connection, the reputation of social media applications, and detected anomalies in user activities within social media networks. The riskiness of an application is assessed based on its correlation with security risks, where higher riskiness indicates a greater likelihood of malicious behavior or vulnerabilities. The reputation of social media applications is analyzed to identify whether they are associated with known threats or suspicious activities. Additionally, the method detects anomalies in user activities within social media networks, such as unusual access patterns or interactions, which may signal potential security breaches or unauthorized access. By combining these parameters, the method provides a comprehensive risk assessment for mobile device connections, enabling proactive security measures to mitigate threats. The approach helps users and security systems identify and respond to potential risks before they escalate, enhancing overall mobile device security in social media and application environments.

Claim 13

Original Legal Text

13. The computer-implemented method of claim 1 , wherein the risk level is based on riskiness of at least one computer device of the user of the mobile device and the mobile device, wherein the riskiness is positively correlated with a security risk.

Plain English Translation

This invention relates to cybersecurity risk assessment for mobile devices and associated computer devices. The method evaluates the overall risk level of a user's mobile device by considering the security riskiness of both the mobile device itself and at least one other computer device used by the same user. The riskiness is positively correlated with security risk, meaning higher riskiness indicates a greater likelihood of security vulnerabilities or threats. The method involves analyzing security factors such as device configuration, software vulnerabilities, network exposure, and historical security incidents to determine the riskiness of each device. By aggregating these risk assessments, the system calculates an overall risk level for the user's digital environment. This approach helps identify potential security weaknesses across multiple devices, enabling proactive risk mitigation. The method may be used in enterprise security systems, mobile device management platforms, or personal cybersecurity applications to enhance threat detection and response. The invention addresses the challenge of assessing security risks in distributed computing environments where users interact with multiple devices, each potentially introducing different levels of risk.

Claim 14

Original Legal Text

14. The computer-implemented method of claim 1 , wherein the malware notification includes remediation instructions.

Plain English Translation

A computer-implemented method addresses the challenge of effectively notifying users about detected malware while providing actionable steps for resolution. The method involves detecting malware on a computing device and generating a notification to inform the user of the threat. The notification includes detailed remediation instructions, guiding the user through steps to remove or mitigate the malware. These instructions may include specific actions such as running a security scan, updating software, or isolating affected files. The method ensures that users receive clear, step-by-step guidance to address the malware, reducing the risk of further infection and minimizing potential damage. By integrating remediation instructions directly into the notification, the system enhances user awareness and empowers them to take immediate corrective action. This approach improves security outcomes by combining threat detection with proactive remediation support.

Claim 15

Original Legal Text

15. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to: identify a mobile device at risk from malware based on a type of the mobile device matching one or more types of devices identified as being at risk from the malware; rank a set of connections of a user of the mobile device using a set of weighted parameters; identify a subset of the set of connections having a risk level greater than or equal to a predetermined risk level based on the ranking; and output a malware notification for the mobile device at risk and at least one user computer device from the set of connections at risk from the malware.

Plain English Translation

This invention relates to cybersecurity for mobile devices and associated user networks. The system detects mobile devices vulnerable to malware by comparing their device type against a database of known at-risk device types. Once identified, the system evaluates the user's digital connections—such as other devices, accounts, or networks—using weighted risk parameters like connection frequency, data sensitivity, or historical compromise rates. Connections exceeding a predefined risk threshold are flagged. The system then generates alerts for both the at-risk mobile device and any high-risk connected devices, enabling proactive security measures. The approach combines device profiling with network risk assessment to mitigate malware spread across interconnected user environments. The weighted ranking ensures prioritization of critical connections, while the automated notification system enhances response efficiency. This solution addresses the challenge of isolating and protecting vulnerable devices within broader user ecosystems, reducing the likelihood of malware propagation.

Claim 16

Original Legal Text

16. The computer program product of claim 15 , wherein the parameters comprise at least one of: riskiness of an application used by a connection, wherein the riskiness of the application is positively correlated with a security risk; the reputation of one or more social media applications being used by the connection; detected anomalies in activities within a social media network of the user of the mobile device; and a level of current, known vulnerabilities for the mobile device and a device of the at least one other user.

Plain English Translation

This invention relates to a computer program product for enhancing security in mobile device communications by analyzing connection parameters to assess and mitigate risks. The system evaluates various factors to determine the security posture of a mobile device and its connections. Key parameters include the riskiness of applications used by a connection, where higher riskiness indicates greater security threats. The reputation of social media applications involved in the connection is also assessed, with lower reputations signaling potential risks. The system detects anomalies in user activities within social media networks, identifying unusual behavior that may indicate security threats. Additionally, it evaluates the level of known vulnerabilities present in the mobile device and the devices of connected users, providing a comprehensive risk assessment. By analyzing these parameters, the system can proactively identify and mitigate security risks, ensuring safer mobile device usage. The invention improves security by dynamically adjusting protection measures based on real-time risk assessments, reducing exposure to threats from applications, social media interactions, and device vulnerabilities.

Claim 17

Original Legal Text

17. The computer program product of claim 15 , wherein the risk level is based on riskiness of at least one computer device of the user of the mobile device and the mobile device, wherein the riskiness is positively correlated with a security risk.

Plain English Translation

This invention relates to cybersecurity risk assessment for mobile devices and associated computer systems. The technology addresses the challenge of dynamically evaluating security risks posed by mobile devices and their users, particularly in enterprise or networked environments where unauthorized or compromised devices can introduce vulnerabilities. The system determines a risk level for a mobile device by analyzing the security posture of both the mobile device itself and at least one other computer device associated with the user. Riskiness is quantified as a metric positively correlated with security risk, meaning higher riskiness indicates greater potential for security threats. The assessment considers factors such as device configuration, software vulnerabilities, user behavior patterns, and historical security incidents. By evaluating both the mobile device and related systems, the approach provides a more comprehensive risk profile than traditional methods that focus solely on the mobile device. The risk level is used to enforce security policies, such as restricting access, triggering additional authentication, or initiating remediation actions. This proactive approach helps prevent unauthorized access, data breaches, or other security compromises by identifying high-risk scenarios before they escalate. The system may also adapt its risk assessment criteria over time based on evolving threat landscapes or organizational security policies.

Claim 18

Original Legal Text

18. A system comprising: a CPU, a computer readable memory and a computer readable storage medium associated with a computing device; program instructions to determine a personal computing device is at risk from malware based on the malware risk data; program instructions to identify a set of connections of a user of the personal computing device, wherein each connection in the set of connections is associated with a user device; program instructions to rank the set of connections using a set of weighted parameters; program instructions to identify a subset of the set of connections having a risk level greater or equal to a predetermined risk level based on the ranking; and program instructions to send a notification regarding malware remediation steps to the personal computing device and at least one user device of the set of connections of the user, wherein the program instructions are stored on the computer readable storage medium for execution by the CPU via the computer readable memory.

Plain English Translation

The system detects and mitigates malware risks across interconnected devices. It operates in the domain of cybersecurity, addressing the problem of malware spreading through user connections, such as shared networks or linked accounts. The system uses a computing device with a CPU, memory, and storage to execute malware risk assessment and remediation. The system first evaluates whether a personal computing device is at risk based on malware risk data. If a risk is detected, it identifies all connections associated with the device's user, where each connection is linked to another user device. These connections are then ranked using weighted parameters, which may include factors like device security posture, connection frequency, or historical risk exposure. The system filters the ranked connections to identify those with a risk level meeting or exceeding a predetermined threshold. Finally, the system sends notifications to both the original personal computing device and the at-risk user devices, providing malware remediation steps. This proactive approach helps contain malware spread by alerting potentially affected devices in a user's network. The system ensures timely intervention by leveraging automated risk assessment and targeted notifications.

Claim 19

Original Legal Text

19. The system of claim 18 , wherein the malware remediation steps are selected from the group consisting of: running a vulnerability scan, and performing a step-up verification.

Plain English Translation

A system for cybersecurity threat detection and remediation is designed to identify and mitigate malicious activities in a computing environment. The system monitors network traffic and system behavior to detect potential security threats, such as malware infections or unauthorized access attempts. Once a threat is identified, the system automatically initiates remediation steps to neutralize the threat and prevent further damage. These remediation steps include running a vulnerability scan to identify and assess system weaknesses that could be exploited by malware, and performing a step-up verification to authenticate users or processes more rigorously, ensuring that only authorized entities can access sensitive resources. The system may also log remediation actions for auditing and compliance purposes, providing a record of how threats were handled. By combining detection and automated remediation, the system enhances security posture and reduces the risk of successful cyberattacks. The system is particularly useful in environments where rapid response to threats is critical, such as enterprise networks or cloud-based infrastructures.

Claim 20

Original Legal Text

20. The system of claim 18 , wherein the parameters comprise at least one of: riskiness of an application used by one of the sets of connections, wherein the riskiness of the application is positively correlated with a security risk; the reputation of one or more social media applications being used by the one of the sets of connection; and detected anomalies in activities within a social media network of the user of the personal computing device.

Plain English Translation

This invention relates to a cybersecurity system for personal computing devices that monitors and evaluates user connections and activities to assess security risks. The system analyzes parameters associated with user connections, including the riskiness of applications used, the reputation of social media applications, and detected anomalies in social media network activities. The riskiness of an application is determined based on its correlation with security risks, where higher-risk applications trigger heightened security measures. The system also evaluates the reputation of social media applications, identifying those with poor reputations that may pose threats. Additionally, it detects anomalies in user activities within social media networks, such as unusual behavior or interactions, which may indicate potential security breaches. By continuously monitoring these parameters, the system dynamically adjusts security protocols to mitigate risks. The system may also generate alerts or enforce restrictions on high-risk connections or applications to protect the user's device and data. This approach enhances cybersecurity by proactively identifying and responding to potential threats based on real-time analysis of user behavior and application usage.

Patent Metadata

Filing Date

Unknown

Publication Date

January 7, 2020

Inventors

Anne L. BOLGERT
Richard J. COHEN
Miguel SANG
Krishna K. YELLEPEDDY

Want to explore more patents?

Browse 5M+ US patents with plain-English claim translations and AI-generated analysis.

Citation & reuse

Analysis on this page is generated by Patentable — an AI-powered patent intelligence platform. AI-generated summaries, explanations, FAQs, and analysis may be reused with attribution and a visible link back to the canonical URL below. Patent abstracts and claims are USPTO public domain.

Cite as: Patentable. “IDENTIFYING AND REMEDIATING MALWARE-COMPROMISED DEVICES” (10530804). https://patentable.app/patents/10530804

© 2026 Nomic Interactive Technology LLC. Machine-readable context available at /api/llm-context/10530804. See llms.txt for full attribution policy.

IDENTIFYING AND REMEDIATING MALWARE-COMPROMISED DEVICES